however this does not work remotely, this is becuase _stack_chk_fail calls __fortify_fail which calls __lib_message which does this:

void__libc_message(intdo_abort,constchar*fmt,...){va_listap;intfd=-1;va_start(ap,fmt);/* Open a descriptor for /dev/tty unless the user explicitly requests errors on standard error. */constchar*on_2=__libc_secure_getenv("LIBC_FATAL_STDERR_");if(on_2==NULL||*on_2=='\0')fd=open_not_cancel_2(_PATH_TTY,O_RDWR|O_NOCTTY|O_NDELAY);if(fd==-1)fd=STDERR_FILENO;// then prints stuff and crashes}

which means that we only need to set LIBC_FATAL_STDERR_ and the flag will get printed over stderr instead of /dev/tty.